4 ms·
I like this idea. It's a stripped down VM capable of only running containers. There are a couple of downsides, compared to straight docker though - you have to
by mbreese 11y ago
I like this idea. It's a stripped down VM capable of only running containers. There are a couple of downsides, compared to straight docker though - you have to go through the VM layer for disk io. So, if you have a shared volume, there will be a performance hit.
However, you get a big boost for security.
This type of tech could make it possible to use (Docker) containers in a true multi-tenant system.
One question though - is it possible to specify the vmem and vcpus for the qemu VM? (Either from the command line or pod file?)
- tbronchain 11y agoHi, Thanks for your interest, and congratulations, you found the original motivations behind Hyper :) To anwer your question, yes, you can specify them. Check out the podfile documentation to know how https://docs.hyper.sh/reference/podfile.html https://docs.hyper.sh/reference/podfile.html
- mbreese 11y agoYep - there it is... I missed that when I first looked. Thanks! As an aside - do you have a feeling for how much processing CPU power or io speed is lost when running in the hyper VM?
- tbronchain 11y agohere you go: https://hyper.sh/faq.html https://hyper.sh/faq.html (performances section) Q: What are the performances of Hyper? Boot: Start a hyper Pod only takes less than 350 millisecond. CPU: CPU Performance overhead is about 0.4 percent. Mem: Memory Performance overhead is about 0.64 percent.
- feld 11y agoContainers have been used in multi-tenant systems for years in both Solaris and FreeBSD via zones and jails
- gnepzhao 11y agoNot sure how secure they are. But sounds a bit scary to run my app in a shared-kernel environment.
- mbreese 11y agoAnd on every Docker thread someone says this. I know I've said it myself. However, Jails and Zones aren't a security panacea either. Especially if the untrusted user has access to both the Jail and the host system. The use case I'm thinking about is on a multi-tenant HPC cluster. There are very few non-Linux clusters like this and all of them require strict security. I'd love to deploy docker containers for data processing, but so far it's not been possible due to security concerns (unless running through a VM first). However, I went ahead and made it explicit that I was referring to Docker containers.
- feld 11y agoWhy would you give a user access to the host environment AND the jail?
- mbreese 11y agoThere are more use-cases than just cloud web apps. The case I mentioned was an HPC cluster. There is a ton of interest in using containers more in HPC, just for the flexibility in administration and versioning aspects. But there is a catch - you need to ensure that each user is completely isolated from the others, users can't have root access, and they can't escape from their containers. These users need to have access to both the host and the jail for practical reasons (mainly due to the way the common batch schedulers end up working and data/storage access). Thus far, those restrictions have made it difficult to deploy Docker (or other containers) on clusters. It is possible to deploy VMs with some schedulers, but it largely hasn't caught on in many places.